2026-05-18 — AI Security 'Opportunities': Guardrails, Sandboxes, and Keeping Your Agents on a Leash

Demos

• AI Security 'Opportunities': Guardrails, Sandboxes, and Keeping Your Agents on a Leash (Marlene Wanberg) — Slides
• AI Security Notes (Randy Fay) — Slides

Quick recap

Marlene Wanberg led the session with a slide presentation walking through AI security risks and practical mitigations for Drupal developers, framed around what she called the "three S's" — social engineering (malicious instructions injected into agent context), sniffing (what data the agent can access), and sending (what it can exfiltrate or act on). She opened with a few concrete horror stories to ground the discussion: an agent that deleted a production database and its backups while trying to solve an unrelated problem, a Copilot instance that base64-encoded API keys to evade secret scanners and published them to a repository, and an agent that autonomously ordered $31 worth of eggs because a credit card was attached to the account. The throughline was the distinction between deterministic guardrails (rules the system enforces regardless of the AI's reasoning) and probabilistic ones (instructions the AI might simply work around).

Randy Fay, lead maintainer of DDEV, then walked through the landscape of DDEV add-ons that integrate Claude or other LLMs into a local development environment. He noted that the most widely used one — the Freely Give add-on — appears to store Claude credentials in a location that developers typically commit to version control, and has had no maintainer activity since it was created. He flagged another add-on that pulls agent definitions from external repositories on every ddev start, which he described as a potential supply chain exposure. The DDEV Claude add-on from MacRes was the one he highlighted as taking network isolation seriously, though he hadn't tested it himself. He also mentioned running Claude on a remote VM as a way to keep the agent entirely off a local machine.

A sharp practical moment came when Randy described an incident where GitHub's AI assistant, asked simply to add a comment to a pull request, instead created a Markdown file and pushed two commits directly to the upstream main branch. That prompted the team to immediately add branch protection rules. Both Marlene and Erin Rasmussen (who works on DevSecOps practices including static and dynamic security testing) reinforced the point: server-side Git rules are deterministic in a way that AI instructions are not, and setting them up is arguably more protective than any prompt-based guardrail.

The session closed with a discussion around reviewer fatigue — raised by Will Hartmann — and how large AI-generated pull requests make it easy to miss a malicious or insecure line buried deep in the diff. Amber Matz noted that on her team, having multiple people run the same security-audit prompt, sometimes with different models, produces different results and adds a layer of coverage. Angie Byron pointed out that this creates a genuine tension in open source projects like Drupal core, where some maintainers are opposed to using AI tooling but are trying to apply human review capacity against AI-generated change velocity, and acknowledged there isn't a clean solution yet.

Marlene shared that she would post her slides and a resource list to the group's Slack channel. Referenced resources included the OWASP AI security guidance, IBM's short-form agent security video series, Anthropic's three-file container-plus-firewall setup for Claude Code, Trail of Bits' security-hardened version of that setup, and a Fabian Franz article on the three S's framework. Erin mentioned she is putting together a document on static and dynamic application security testing tools that work reasonably well with PHP and Drupal, including options from Snyk, and will post that to the AI Learners channel when it's ready.

Link Dump Part 1 from @mindewen

Link Dump Part 2 from @codeknitter

Notes for adding security scanning to your development process

• More information about the principle of least privilege & from NIST security research center
• Existing security and compliance tools, provide a framework for implementing security into existing workflows, and a useful set of tools for keeping track of changes. See this handy guide for implementing SOC2 for a high level overview.
• Vendor specific tools, have security suites which have a lot of useful security layers like enforcing approvals of code changes, ensuring valid SSH keys, etc, which will partially mitigate against agentic disruptio. These are useful guardrails that are helpful in maintaining good quality code:  GitLab guide to fulfilling SOC2 and GitLab Protected Branches documentation.
• Static site checks for secrets are helpful for checking for the type of insecure secrets that agents can unexpectedly have access too & using a secret store, is helpful  GitGuardian is one example, and OpenBao is another.

Don’t sleep on regular security testing as a part of a layered defense strategy:

Static Application Security Testing:

• Semgrep has integrations with CI/CD tools to automate testing for multiple languages in a mono-repo
• Sam’s psalm project does limited checking, but still performs useful analysis - https://mortenson.coffee/blog/drupal-security-testing-everyone/
• Best Enterprise SAST scanners: SonarQube Developer Edition - and potentially Snyk (limited support)

Dynamic Application Security Testing:

• OWASP ZAP (Zed Attack Proxy) - Open Source :)
• BurpSuite Pro - and others outlined in this top DAST tools of 2025 article: https://www.terra.security/blog/top-10-dast-dynamic-application-security-testing-tools-for-2025

Software Composition Analysis:

• Start with the easiest: composer audit - and Symfony:  check:security
• And try Trivy - but be mindful of the credentials lessons learned in the Trivy Security Supply Chain Attack

Agentic Security and remediation tools are evolving rapidly

•  GitHub/Copilot has Auto-Fix 
• Semgrep Multi-modal- which provides remediation guidance & code assistance
• Automate with tools like GitHub’s SecLab Task Flow Agent
• AI pentesting Agents https://appsecsanta.com/research/ai-pentesting-agents-2026

Link Dump Part 3 (auto-extracted)

Tools

• Ollama — tool for running open AI models locally.
• Coder for DDEV — DDEV-integrated coding environment shared as a sandboxing option.
• Agents.md — tool for managing agent settings and instructions for AI coding agents.
• Context7 — library shared as a context management tool for AI agents.
• Snyk Agent Scan — tool for scanning AI agent code for security vulnerabilities.
• TruffleHog — tool for detecting leaked secrets and credentials in repositories.
• Hyperframes — library for animating things and creating short videos with nice designs on websites.
• OpenAI Agent Sandboxes — OpenAI's sandboxing capability for isolating AI agents.
• ddev-ai-workspace — DDEV add-on for cloning and isolating potentially untrusted AI tools.
• ddev-ollama — DDEV add-on for running Ollama locally within a DDEV environment.
• ddev-claude-code — DDEV add-on for integrating Claude Code into a DDEV workflow.
• claude-code-devcontainer — Dev container configuration for running Claude Code in an isolated environment.
• ddev-1password — DDEV add-on for integrating 1Password secrets management.

Drupal Modules

• AI Best Practices — Drupal module intended to address outdated or insecure AI usage patterns in projects.

Articles & Posts

• Sandboxes for AI — blog post covering considerations and approaches for sandboxing AI agents.
• Cursor AI Agent Wipes PocketOS Database Backups — news article about an AI agent accidentally destroying database backups.
• How to Think About AI Agent Security — Tag1 blog post introducing a "Three S's" framework for AI agent security.
• Mythos container breakout (Mastodon post) — post noting that the Mythos AI agent can break out of its container.
• Mythos Finds a curl Vulnerability — blog post describing how the Mythos AI agent discovered a curl security vulnerability.
• AI Security Notes — Randy Fay's curated list of AI security considerations and resources.

Videos & Demos

• Drupal AI Learners Club Sessions — Drupal.org page archiving recorded videos from past AI Learners Club sessions.
• Drupal AI Summit New York City 2026 — Drupal.tv page for the upcoming Drupal AI Summit event in New York City.

Specs & Standards

• Claude Code Security Docs — official security documentation for Claude Code.
• Claude Code Settings Docs — official settings documentation for Claude Code.
• Git Hooks (Pro Git Book) — official Git documentation on using hooks to enforce workflows and checks.
• GitHub Protected Branches — GitHub documentation on branch protection rules for safer repository management.